If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (a4e42ea741c3a61878fa72cd8b7ab4547c52f14b69f429129c46edba70771287)
index.mjs (the package's main entry) contains a ~500 KB base64-encoded x86-64 ELF payload stored in a `_store` array disguised with a `// --- Calibration Data ---` comment. On import, the module joins the base64 chunks, writes the decoded bytes to disk with mode 0o755, dynamically imports `node:child_process`, and executes the dropped binary. The behavior fires as a top-level import side effect, so any consumer that `require`s or `import`s the package runs the embedded native code. The file's header comment labels the module `streak-larq-hydration` and references `svelte-insight-hydration`, while the package is published as `streak-cal-core` with a README pointing at `svelte-streak-cal` — internal naming does not match the published identity, consistent with a family of sibling typosquat variants. The advertised purpose (dependency-free calendar/streak math helper) is inconsistent with shipping and executing an opaque native binary.